[Bug 80157] Buffer Overflow in xf86-video-intel

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=80157

--- Comment #25 from Chris Wilson <chris at chris-wilson.co.uk> ---
To test the theory that we are being given garbage, can you please try running
with:

diff --git a/src/sna/sna_dri2.c b/src/sna/sna_dri2.c
index cfe65f4..a8d3848 100644
--- a/src/sna/sna_dri2.c
+++ b/src/sna/sna_dri2.c
@@ -2631,6 +2631,13 @@ sna_dri2_schedule_swap(ClientPtr client, DrawablePtr
draw, DRI2BufferPtr front,
        struct sna_dri2_event *info = NULL;
        CARD64 current_msc;

+       if (client->osPrivate == NULL) {
+               ErrorF("%s: called with dead client\n", __func__);
+               return BadMatch;
+       }
+       IgnoreClient(client);
+       AttendClient(client);
+
        DBG(("%s: draw=%lu %dx%d, pixmap=%ld %dx%d, back=%u (refs=%d/%d,
flush=%d) , front=%u (refs=%d/%d, flush=%d)\n",
             __FUNCTION__,
             (long)draw->id, draw->width, draw->height,

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20140620/cd67548e/attachment.html>